Security Fundamentals for CompTIA Tech+ (FC0-U71): CIA Triad, AAA, and Non-Repudiation Explained

If you've been working through CompTIA Tech+ (FC0-U71) one domain at a time, you've probably spent the most energy on hardware, operating systems, and software development concepts. But Domain 6.0, Security, carries real weight on the exam — roughly 19% of the test — and it's the domain most candidates underestimate because the concepts feel "obvious" until a question is worded precisely. This guide covers the foundational building blocks in objective 6.1: the CIA Triad, the AAA model (Authentication, Authorization, Accounting), non-repudiation, and the privacy basics Tech+ expects you to recognize.

These aren't just Tech+ trivia. They're the vocabulary every other CompTIA security certification builds on, from Identity and Access Management on Security+ to zero trust architecture on SecurityX. Get the definitions locked in now, at the FC0-U71 level, and every later cert gets easier.

What CompTIA Tech+ Domain 6.0 Actually Tests

Domain 6.0 on the FC0-U71 exam is titled simply "Security," and it's broken into five sub-objectives: 6.1 fundamental security concepts, 6.2 securing devices and best practices, 6.3 password best practices, 6.4 encryption use cases, and 6.5 small wireless network security. This article focuses on 6.1, which CompTIA treats as the conceptual foundation for everything else in the domain. If you can't explain confidentiality versus integrity, or authentication versus authorization, the rest of Domain 6.0 — and every security-adjacent question elsewhere on the exam — gets harder than it needs to be.

Tech+ doesn't expect CISSP-level depth here. It expects you to recognize the term, know what problem it solves, and pick the right answer when a scenario describes it without naming it outright. That's exactly how CompTIA tends to phrase these questions, so precise definitions matter more than they might seem to at first glance.

The CIA Triad: Confidentiality, Integrity, and Availability

The CIA Triad is the single most foundational model in all of information security, and Tech+ introduces it before any other exam in the CompTIA lineup does. Each leg of the triad answers a different question about data:

• Confidentiality — Is this information visible only to the people who are supposed to see it? Encryption, access controls, and permissions all exist primarily to protect confidentiality.
• Integrity — Has this information been altered, either by accident or by an attacker, since it was created or last verified? Hashing and checksums are the classic tools for verifying integrity.
• Availability — Can authorized users actually get to the data and systems they need, when they need them? Backups, redundancy, and uptime planning all serve availability.

A useful exam trick: whenever a question describes an attack or a control, ask which leg of the triad it primarily threatens or protects. A denial-of-service attack targets availability. A tampered file targets integrity. A leaked customer database targets confidentiality. For a deeper, example-driven walkthrough of how each leg plays out in real incidents, see our full CIA Triad breakdown.

Authentication, Authorization, and Accounting (AAA)

Once you understand what you're protecting, the next question is how you control who gets access to it. That's where the AAA model comes in, and it's one of the most frequently tested acronyms across the entire CompTIA catalog:

• Authentication — Proving you are who you claim to be. This is the login step: a password, a fingerprint, a one-time code.
• Authorization — Determining what an authenticated user is actually allowed to do. Being logged in doesn't mean you can access everything; authorization enforces permissions and the principle of least privilege (standard user accounts versus administrator accounts, for example).
• Accounting — Recording what happened. Logs, timestamps, location data, and browser history all fall under accounting, because they create a record you can review later.

Tech+ candidates sometimes confuse authentication and authorization because both happen right after you log in, but the exam tests the distinction directly: authentication is about identity, authorization is about permission. Our dedicated AAA explainer walks through how these three pieces work together in a real network, and our authentication factors guide digs into the "something you know, have, and are" categories that Tech+ and Security+ both expect you to recognize on sight.

Non-Repudiation: Proving Who Did What

Non-repudiation is the concept candidates most often skip past, because it sounds abstract until you see it applied. In plain terms, non-repudiation means a person cannot credibly deny having performed an action, because there's verifiable evidence tying that action back to them specifically.

Think about the difference between a shared department login and an individual employee account. If five people share one login and something goes wrong, nobody can be held accountable — there's no non-repudiation. If everyone logs in with their own credentials and every action is logged under that identity, the organization has non-repudiation: the log entry, combined with the authentication event, proves who did it.

Digital signatures are the clearest real-world example. When someone digitally signs a document, the cryptographic signature ties that specific action to that specific identity in a way that's extremely difficult to forge or deny later. On the Tech+ exam, expect non-repudiation to show up as the answer whenever a scenario emphasizes accountability or the inability to deny an action after the fact — not simply "a log exists," but "this log can be tied conclusively to one identity."

Privacy Basics: PII, GDPR, and Cookie Consent

Objective 6.1 also expects familiarity with privacy as a security concern in its own right, specifically across social media, email, file sharing, and instant messaging. Three terms come up repeatedly:

• PII (Personally Identifiable Information) — Any data that can identify a specific individual: full name, Social Security number, address, or email combined with other identifying details. Our sensitive data overview covers how PII fits alongside other classification categories.
• GDPR (General Data Protection Regulation) — The European Union framework that governs how organizations collect, store, and process personal data, even for companies outside the EU that serve EU residents. Tech+ wants you to recognize GDPR by name and understand that it exists to protect individual privacy rights; our GDPR deep dive covers the regulation in full.
• Cookie consent — The notices websites display asking permission to track browsing activity. It's a direct, visible application of privacy law that Tech+ test-takers encounter every day, which is exactly why CompTIA includes it at this level.

The exam angle here is usually recognition rather than deep regulatory knowledge: know that GDPR protects personal data, know that PII is the category of data being protected, and know that accounting (from the AAA model above) and privacy are related but distinct concepts — accounting tracks actions, privacy protects data about people.

Exam Tips for FC0-U71 Domain 6.1

• When a question describes an attack or failure, identify which leg of the CIA Triad is primarily at risk before you look at the answer choices — it narrows the field fast.
• Memorize AAA in order: Authentication happens first (identity), Authorization second (permission), Accounting third (the record). Questions often test whether you understand the sequence.
• If a scenario mentions "proof" or "cannot deny" an action, non-repudiation is almost always the intended answer, not simply "authentication" or "logging" alone.
• Don't confuse privacy (protecting data about people) with confidentiality (restricting access to data in general) — they overlap but aren't identical on the exam.
• Tech+ questions on this domain are scenario-based more often than definition-matching, so practice applying each term to a short story rather than just memorizing the glossary entry.

Key Takeaways

• The CIA Triad — Confidentiality, Integrity, and Availability — is the foundational model for evaluating any security control or attack on the Tech+ exam.
• AAA (Authentication, Authorization, Accounting) separates proving identity, granting permission, and recording activity into three distinct, testable steps.
• Non-repudiation means an action can be conclusively tied to one identity, so that identity cannot credibly deny having performed it.
• Privacy concepts like PII and GDPR extend security thinking beyond systems to the people whose data those systems hold.
• These Domain 6.1 concepts are the vocabulary foundation for Security+, Network+, and every other CompTIA security-adjacent exam that follows Tech+.